Product security and the CRA
From the prototype that works to the product that can be sold in Europe: classification, conformity plan, firmware engineering, SBOM, documentation and coordinated disclosure.
Secure by design for the people who make connected products.
The Cyber Resilience Act makes the manufacturer responsible for a product's security across its whole life cycle, not just at the moment it leaves the factory. We treat it as an engineering problem.
Independent, Portuguese and technical consultancy: product security and CRA preparation, offensive assessments from the firmware to the premises, and a product of our own that goes through the same sieve.
The CRA guide for manufacturersWhat we do
You make a connected product and want to know where it stands under the CRA? Ask for a first read, at no cost
New, · PHP2Shell and Node.js: what they ask of device makers · The rest of the stack: Linux kernel, Python, certificates
Three lines of work
Offensive assessments
Whitebox pentesting of firmware and systems, threat modelling and physical intrusion of premises, always with a written scope and authorisation. It is where we come from.
Aeromate
Our own environmental-control product, with an open Community edition and a public logbook of its preparation for the CRA. What we advise, applied to ourselves.
CRA calendar
414 daysuntil Full application for manufacturers (11 Dec 2027)
- 10 Dec 2024The Cyber Resilience Act enters into force. Manufacturer obligations only become applicable later, in phases. Regulation (EU) 2024/2847
- 27 Jul 2026The European Commission publishes non-binding guidance on applying the CRA: scope, substantial modification, support period, reporting and risk assessment. European Commission, Communication C(2026) 5252 (guidance under Article 26)
- 11 Sep 2026The reporting obligations become applicable: an early warning notification within 24 hours and a vulnerability or incident notification within 72 hours, for actively exploited vulnerabilities and severe incidents. Notifications go through ENISA's single reporting platform, operational since the same date. Regulation (EU) 2024/2847, Article 14
- 11 Dec 2027The CRA becomes fully applicable. From here on, products with digital elements placed on the market must meet the essential cybersecurity requirements. Regulation (EU) 2024/2847
Where we come from
We come from offensive security: pentesting, red teaming, OffSec certifications. That is the angle we bring to a product. We follow the path an attacker would take. In a market where the CRA is sold as an audit, the difference shows in the report.
The automotive sector has already been through this transition, with UNECE R155/R156 and ISO/SAE 21434. In practice, those standards are a secure development life cycle applied to a connected physical product. Vehicles are excluded from the CRA precisely because they already have a regime of their own, which is why they preview what is coming for everyone else.
| Sector | Regime they face |
|---|---|
| Automotive German car manufacturer | UNECE R155/R156 · ISO/SAE 21434 |
| Telecommunications Tier-1 operator | NIS2 · Decree-Law 125/2025 |
| Banking Portuguese retail bank | DORA |
| Fintech B2B payments | DORA |
| Integration International consultancy (partnership) | Varies with the end client |
Clients identified by generic descriptor. Scopes of work, findings and architectures are never published.
And from the maker's side of the table
We are developing Aeromate, our own environmental-control product for drying and maturation. When it reaches the market, it will be subject to the same regulation we advise on.
That forces us to walk the whole path ourselves: SBOM, support-period decisions, a coordinated vulnerability disclosure process, conformity assessment. The logbook documents that preparation in the open, including any decisions that turn out badly.
A note on rigour. Folhas Etéreas does not yet place products on the market, so no CRA deadline applies to us directly. The dates on this page are the regulation's calendar, not an obligation of ours.
Latest articles
The rest of the stack: Linux kernel, Python, certificates
The PHP2Shell week also brought fixes for the Linux kernel, for Python and for the certificate store. For manufacturers, the question is the same at all three layers: by what route, and with what delay, the fix reaches the devices already sold.
PHP2Shell and Node.js: what they ask of device makers
On 21 October 2026, PHP and Node.js released serious security fixes. Anyone making devices with a web panel, gateways or Node executables has three questions to answer: whether the product contains the component, whether there is a duty to report under Article 14, and how the fix reaches the units already in the field.
Coordinated vulnerability disclosure: the channel the CRA requires you to keep open
The reporting obligations towards the authorities are now applicable, but they are half of the circuit. Annex I, Part II demands the other half: a public channel for receiving vulnerability reports, with a policy, a point of contact and a process behind it. It costs little to set up, and there is a standard for almost everything.